Most likely the problem lies in ClassFilterImpl.isPluginManifest as called by isLocationWhitelisted. The reporter is running on Tomcat rather than the built-in Winstone like most users, so that is very likely the cause. Now 2.104 fixed JENKINS-49147 but perhaps you are seeing some similar issue caused by another weird Tomcat behavior, perhaps depending on the specific version being run. You can turn on logging on ClassFilterImpl to pinpoint the problem easily.